Forum Discussion
iRule config to Rewrite SSL Header for Transactions
We need to pull three values out of the Client SSL and put them in the Server SSL. Currently we tried using a rule that creates a Session Table to store these. Since this is a API and not a web page we are having timeout issues. Any suggestions on rewriting this would help.
This is part of what we are using.
when CLIENTSSL_CLIENTCERT {
Check if client presented at least one cert if {[SSL::cert count] > 0}{
Insert the following fields in the session table with a timeout of 7200 seconds:
Do the processing now as opposed to in HTTP_REQUEST as there
can be many HTTP requests using the same SSL session ID
Index - item
1 - serial number of the cert
2 - issuer of the cert
3 - subject of the cert
session add ssl [SSL::sessionid] [list \
[SSL::verify_result] \
[X509::serial_number [SSL::cert 0]] \
[X509::issuer [SSL::cert 0]] \
[X509::subject [SSL::cert 0]] \
] 7200
log local0. "[IP::client_addr]:[TCP::client_port]: Added session data for cert. Status:\
[X509::verify_cert_error_string [lindex [session lookup ssl [SSL::sessionid]] 0]] with key [SSL::sessionid]"
} }
12 Replies
- Kevin_Stewart
Employee
Replacing your existing header insert calls.
- Kevin_Stewart
Employee
You just need to replace the section in your code where you generate the HTTP headers in the HTTP_REQUEST event. In my last example, I used the SSL session table that you created in the CLIENTSSL_CLIENTCERT event. That should work fine. Alternatively, and again this I believe depends on BIG-IP version, you could skip the SSL session table and simply render the SSL::cert data directly in the HTTP_REQUEST event.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com